System call interception for serverless isolation

Serverless functions [6, 9, 13, 14], like AWS Lambda [3] or Google Cloud Functions [7], are new techniques for running short-lived workloads over a cloud, which are particularly preferred by users for their easy deployment, fine-grained billing and automatic scaling. Unlike traditional cloud offerings such as VMs and containers, these functions are stateless, where each function execution starts with a fresh state of memory, disk, and other resources. A multi-tenant serverless cloud platform has two primary components, a gateway controlled by the cloud service provider (CSP) and the user functions which are users' programs. A typical serverless function execution is stateless and involves broadly the following steps: (1) User request is received by the gateway, (2) Gateway executes the function and passes the request arguments, (3) The function performs necessary computation, (4) Optionally, it can call other functions through the gateway or access external Database, and (5) It returns the result to the user.